Internal Audit for Top Management / ISO 9001:2008

F

fregando

#1
Hello everyone,
I need to perform the anual internal audit as usual; however, the company has changed ownership and the new management is giving new directions and policies, which is expected and normal; still, how can i conduct the audit during this period?. There will be lots of findings and what made sense for the previous management, is not under the new one.
We need to have a Management review meeting, so we can set the objectives for this year and so fort, but we also need to present all the findings from the audit with their corresponding action plan.. how do u think the external auditor will find the amount of findings raised during the internal audit?.
And my other concern is: are the external auditors auditing according to the new version of ISO 9001? whar if i have some work in progress by the time of the external audit?

I hope you guys can give some guidance.
Regards,

Fernando
 
Elsmar Forum Sponsor

Jen Kirley

Quality and Auditing Expert
Staff member
Admin
#2
Can you change the audit schedule to give management more time to make their objectives?

If not, if your management had objectives before, but the objectives will now substantially change and are under review for that, I would just ask about the process, either underway or expected, for identifying objectives; and then how they will want to learn about the progress, and what the expectation is once they receive the data. After all, without a process for all this, objectives have no meaning at all.
:2cents:
 
C

Craig H.

#3
I agree with Jennifer. Also, you have some time before you have to adopt the new standard, so I would move that to the back burner for now. (That said, if you were complying to the 2000 version there will not be much to change for the new version). If your external audit schedule is set, and will come up soon, it is better to have many nonconformances documented in your C/A system, and be working on them, than to have the auditor come in and have a field day, IMHO.
 
#5
Hello everyone,
I need to perform the anual internal audit as usual; however, the company has changed ownership and the new management is giving new directions and policies, which is expected and normal; still, how can i conduct the audit during this period?. There will be lots of findings and what made sense for the previous management, is not under the new one.
I hope you guys can give some guidance.
Regards,

Fernando
Fernando:

Do you only do one (1) internal audit, covering the whole system? If so, you are non-compliant to ISO 9001, which requires audit programs (a number of audits) to be scheduled based on status and importance. By doing smaller (scope), more frequent audits, you won't run into this problem again.....you won't generate so many audit findings at one time and it won't seem so overwhelming.
 
Last edited:
J

JaneB

#6
And my other concern is: are the external auditors auditing according to the new version of ISO 9001? whar if i have some work in progress by the time of the external audit?
Don't worry too much (if at all) about having 'work in progress' at any external audit. You run the system for your company (not for your external auditors), and any good auditor will take the time to ask questions about what's been happening since their last visit, before they start to audit so they get the context. This normally happens at the opening meeting, but if by any chance it doesn't, just explain what's been happening and how big the changes have been.

They will understand you can't do everything all at once/very quickly after such a major change. Provided they can see good evidence of things happening (eg, a plan, objectives and progress) they'll be fine with that.
 

RoxaneB

Super Moderator
Super Moderator
#7
fregando said:
I need to perform the anual internal audit as usual; however, the company has changed ownership and the new management is giving new directions and policies, which is expected and normal; still, how can i conduct the audit during this period?. There will be lots of findings and what made sense for the previous management, is not under the new one.
There is one key distinction that makes a solid and mature Management Shine shine above one that exists "for the certificate" only...the ability to survive and adapt through major changes. A robust Management System should not stop because of a change...it may slow down, some priorities may be re-prioritized...but at the end, the Management System has the tools, techniques and methodologie to get things back up to optimum speed.

Things to look for during the audit may include...

Does your Management System have controls in place that will effectively implement and communicate new directions and policies?

Is there a training plan for the new management to help them become more familiar with the existing processes?

Are Customer and Regulatory requirements still being met or has all control of processes being lost?

fregando said:
We need to have a Management review meeting, so we can set the objectives for this year and so fort, but we also need to present all the findings from the audit with their corresponding action plan.. how do u think the external auditor will find the amount of findings raised during the internal audit?.
You can also use the Mangement Review meeting as a kind of training session...an introduction of the Management System to the new people. They may have questions. They may want to understand what you measure and why. They may want to dig deeper into your improvement areas to fully understand the justification. This is a perfect opportunity.

I don't believe a good external auditor will look at the number of findings, per se, but more at the caliber/nature of the findings. As well, as a result of the significant change that has happened, if there are some heavy findings, you may wish to reschedule another audit towards the end of the year - this will enable the team to see if the findings have been resolved or if more indepth action plans are required.

fregando said:
And my other concern is: are the external auditors auditing according to the new version of ISO 9001? whar if i have some work in progress by the time of the external audit?
You should contact your registrar for an answer to this one. At the same time, you may with to outline your concerns with the registrar to see if they are able to provide you an alternate date for an external audit. This will give your organization more time to adjust to the change and perhaps implement some of the easier-to-do actions from any internal audit findings (i.e., demonstrate to the external auditor that the new management is commited to the Management System).
 
J

JaneB

#8
There is one key distinction that makes a solid and mature Management Shine shine above one that exists "for the certificate" only...the ability to survive and adapt through major changes. A robust Management System should not stop because of a change...it may slow down, some priorities may be re-prioritized...but at the end, the Management System has the tools, techniques and methodologie to get things back up to optimum speed.
Very, very true.

Excellent post, Roxanne, with excellent advice.

I agree that it's an excellent opportunity to use the Management Review meeting as a kind of introd to the system (for top management), and a real opportunity for them to ask questions and have a (I hope) fruitful discussion. Now that's a real review.
 
F

fregando

#9
Thanks very much guys for all your comments. In fact my plan was to have this audit at the end of 2008; however, because of these changes I decided to re-schedule it.
As Roxanne said, it is a great opportunity to show the system to the new management but I am afraid it could be kind of overwelming, specially for the one that have to do most of the work, meaning, ME...lol.
I will contact the registrar for sure and let them know about this transition period and how we can handle the next audit.
I have another question. Is it possible to raise a major finding for a non-conformance to a general clause instead of going into the detail of every single item of the clause?... I am asking this with the intention of avoid paperwork. The root-cause is pretty much the same and the solution could be to review the whole aspect and reflect current policies.
Thanks again,
Fernando
 

howste

Thaumaturge
Super Moderator
#10
I have another question. Is it possible to raise a major finding for a non-conformance to a general clause instead of going into the detail of every single item of the clause?... I am asking this with the intention of avoid paperwork. The root-cause is pretty much the same and the solution could be to review the whole aspect and reflect current policies.
Thanks again,
Fernando
The short answer is yes. But first, are you sure that there are as many problems as you think there are? I'd recommend that you don't go into the audit with the assumption that because the new management team has been making changes, that the things they are doing now don't meet requirements. Keep an open mind and see if what they are doing, even if it's different from what's been done in the past, will meet requirements and be effective for the organization. If there are problems, you should be able to provide them with objective evidence...
 
Thread starter Similar threads Forum Replies Date
K Should Internal Audit Plan be Approved by Top Management? Internal Auditing 19
L Top Management - Internal Audit Questions to Ask Internal Auditing 17
G Questionnaire for Internal Audit of Top Management Internal Auditing 9
S Auditing the Top Management during the Opening Meeting of Internal Audit Internal Auditing 21
D Internal Quality Audit - Desk Top Audit First? General Auditing Discussions 8
Q ISO 9001-2015 Internal audit finding Internal Auditing 12
lanley liao How to understand this words that the planning of internal audit shall take into consideration the results of previous audits? Oil and Gas Industry Standards and Regulations 10
A Add MDSAP to Internal Audit Schedule Medical Device Related Regulations 0
J IATF 16949 Internal Audit question - Auditor's responsibility Internal Auditing 6
S IATF 16949 Internal Audit Example IATF 16949 - Automotive Quality Systems Standard 7
R AS9100D internal audit checklist or ISO 9001 2015 to AS9100 D AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 2
M ISO 13485:2016 internal audit checklist Medical Device and FDA Regulations and Standards News 5
A Internal Audit Questions ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 11
salaheddine96 Internal audit planning Internal Auditing 2
M ISO 9001 Major Nonconformance Internal Audit Schedule/COVID-19 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 18
E MDR internal audit Internal Auditing 1
U Internal Auditor not trained but done Audit for some process Nonconformance and Corrective Action 5
B Looking for 10 Internal Audit Online Training Participants ISO 17025 related Discussions 2
H AS9100 Checklist for Internal Audit needed AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 2
A What are the pros and cons of using an audit software for internal auditing? General Auditing Discussions 7
F Internal Audit before Pre-Assessment ISO 17025 related Discussions 2
Q Internal audit plan template Internal Auditing 12
L Internal audit during COVID-19 restrictions ISO 13485:2016 - Medical Device Quality Management Systems 5
O ISO13485 implementation - Are internal audits expected before stage 1 audit? Design and Development of Products and Processes 3
B Using Unreleased Documents & Process Maps for Internal Audit purposes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
N Small Company - Internal audit process - Who does the audit? Internal Auditing 16
J Does anyone have an excel IATF 16949 Internal Audit checklist I could use? IATF 16949 - Automotive Quality Systems Standard 7
G Addressing Non-Conformances from an Internal Audit that are not product related ISO 13485:2016 - Medical Device Quality Management Systems 11
S Internal audit discrepancy - We missed a few audits that were scheduled Internal Auditing 12
Raffy ISO 14001 9.2.2 Internal Audit Programme Content Internal Auditing 10
N Internal Audit Schedule – Who gets to set the schedule? Internal Auditing 16
V IATF 16949 9.2.2.1 Internal Audit Program - "Process Changes" IATF 16949 - Automotive Quality Systems Standard 11
G Non Conformance During ISO 9001 Audit - Not All Internal Audits Completed General Auditing Discussions 19
B Using external FDA and ISO 13485 audit as internal audit Internal Auditing 6
T Internal Audit Schedule when Hiring Out Internal Auditing 7
D ISO 9001:2015 Internal Audit Training Advice Internal Auditing 10
M Internal audit consultant ISO 13485 (English speaker) Consultants and Consulting 3
S Implementing a 45001 Health & Safety standard - Internal audit plan wanted Internal Auditing 1
F Internal Audit - Procedure example Internal Auditing 5
C Internal Audit - Process Clause Matrix / Audit Checklist ISO 13485:2016 - Medical Device Quality Management Systems 7
CPhelan Internal audit - Combine similar nonconformities in one or keep separate? Internal Auditing 6
M Internal Audit Plan in Retail Internal Auditing 10
D Management of NC after internal system audit IATF 16949 - Automotive Quality Systems Standard 7
A Purchasing - Internal Audit Questions Internal Auditing 8
N Comprehensive Compliance Matrix for Internal Audit Checklist Other Medical Device Regulations World-Wide 1
W Where to begin with an ISO 9001:2015 internal audit Internal Auditing 13
D Internal audit forms or checklists for a medical/veterinary laboratory General Auditing Discussions 5
E Informational Internal Audits - Wear multiple hats what can and can't I audit (so I'm not auditing my own work) Internal Auditing 149
E ISO 9001:2015 - Internal Audit Plan Clauses General Auditing Discussions 8
S Internal Audit Checklist for Application/Software development IEC 27001 - Information Security Management Systems (ISMS) 1

Similar threads

Top Bottom